Alertas de Seguridad de la Información

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-78274] Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.

Editor Arbitrary File Upload in Fluent Boards Pro

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-78276] Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.

Editor PHP Object Injection in Fluent Boards Pro

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-78281] Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.

Unauthenticated Cross Site Scripting (XSS) in CP Media Player

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-78283] Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-78257] Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.

Contributor PHP Object Injection in Booking and Rental Manager

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-78260] Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.

Unauthenticated SQL Injection in Epayco

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-59354] In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynami…

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possesses a valid Initial Access Token can register a malicious client with crafted metadata, which, depending…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-27330] Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.

Unauthenticated Broken Access Control in Mobile App for WooCommerce

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-32479] Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-32550] Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.

Subscriber SQL Injection in Kadence Shop Kit

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-32564] Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-32566] Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.6…

Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-78137] The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on…

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-78333] The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submit…

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-77016] The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user'…

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-77017] The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may s…

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its configuration file and authentication secrets.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-77018] The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may s…

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-59270] Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an a…

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-47890] Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Event…

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-47891] A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not corr…

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

nvdcriticovulnerabilidad CVSS 9.8 NVD